Executive brief
@roomi-fields/notebooklm-mcp is a library that allows LLM applications to batch process answers into a vault directory. A path traversal flaw in the vault batch tool allows attackers or prompt-injected LLMs to write markdown and JSON files to arbitrary locations on the server—potentially enabling data exfiltration or code execution via planted shell startup files or autostart folders.
Technical details
The vulnerability is a path traversal in the vault_batch MCP tool and its equivalent HTTP /batch-to-vault endpoint. The vault_dir parameter is passed directly to path.resolve() and fs.mkdir() without containment checking, allowing directory traversal via absolute paths or ".." sequences. Additionally, the slug_prefix parameter is concatenated into filenames without sanitization, enabling escape through path separators. An unauthenticated attacker or prompt-injected LLM can write .md and .json files to any location writable by the server process. The flaw affects versions v1.6.0 through v2.0.2 and is fixed in v2.0.3 by introducing realpath-based containment (when NOTEBOOKLM_VAULT_ROOT env var is set) and sanitizing slug_prefix.
Affected products
- @roomi-fields notebooklm-mcp v1.6.0 through v2.0.2
Timeline
- 2026-09-22: disclosed: GHSA advisory published
- 2026: patched: Fixed in v2.0.3